Incident: A code sandbox that shared its server's runtime

Module 10 · Incident file · About 30 minutes

What happened

mcp-run-python was Pydantic's MCP server for running Python that a model writes, the code execution shape from Lesson 1. Its repository describes it as an "MCP server to run Python code in a sandbox", and its README said: "Code is executed using Pyodide in Deno and is therefore isolated from the rest of the operating system" (pydantic/mcp-run-python, fetched 13 October 2026). The code had moved there from Pydantic AI; the repository was created on 1 September 2025, and the last release, 0.0.22, reached PyPI on 11 December 2025 (PyPI).

On 9 February 2026 JFrog Security Research published JFSA-2026-001653030, found by Natan Nehorai and tracked as CVE-2026-25905: "Lack of isolation in mcp-run-python leads to MCP server takeover" (JFrog). In JFrog's words, "The Python code being run by “runPython” or “runPythonAsync” is not isolated from the rest of the JS code, allowing any Python code to use the Pyodide APIs to modify the JS environment. This may result in an attacker hijacking the MCP server - for malicious purposes including MCP tool shadowing."

The GitHub advisory, GHSA-pfv4-wmph-5gc6, lists every version up to 0.0.22 as affected, no patched version, a CVSS score of 5.8 and weakness CWE-653, "Improper Isolation or Compartmentalization" (GitHub Advisory Database, updated 12 February 2026). JFrog adds that the project "is archived and unlikely to receive a fix", and "No mitigations are supplied for this issue." The cost on record is the tool itself: the advisory tells users to stop using the package, and the README now opens with a notice that the project is retired because "there's just no safe way to run Python within pyodide safely with reasonable latency".